CVE-2026-14328 is a privilege escalation vulnerability in the Eazy Plugin Manager WordPress plugin (up to version 4.4.1). The vulnerability stems from the `wp_ajax_pos_get_option` AJAX handler which only verifies a nonce localized to logged-in admin users but lacks capability checks, allowing any authenticated user with at least Subscriber privileges to read arbitrary WordPress options via `get_option()`. Combined with the `admin_login_endpoint_handler` REST endpoint (`GET /wp-json/epm/v1/admin/login`), which is publicly accessible and authenticates callers solely by a whirlpool hash of values stored in these options, an attacker can extract sensitive connection data (`site_url`, `connection_key`, `remote_user_id`) from options `eazywp_connecting_info` and `eazywp_connection`. Using these, the attacker can compute the required authentication key, invoke the REST endpoint, obtain administrator authentication cookies, and fully compromise the site. This attack requires the plugin's remote connection feature to be configured and populated with valid credentials.

An attacker with Subscriber-level or higher access can escalate privileges to administrator by exploiting insufficient authorization in the plugin's AJAX handler and abusing a publicly accessible REST endpoint. This leads to full site takeover, including confidentiality, integrity, and availability impacts (C:H/I:H/A:H). The vulnerability allows reading sensitive plugin configuration options and bypassing authentication mechanisms.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin usage to trusted users only and consider disabling the remote connection feature if not required. Monitor for updates from the vendor and apply patches promptly once released.